The vulnerability involves multiple denial‑of‑service flaws in React Server Components. By sending specially crafted HTTP requests to Server Function endpoints, an attacker can trigger server crashes, out‑of‑memory errors, or excessive CPU usage. This flaw depends on the specific code path executed and the application configuration, leading to availability loss and resource exhaustion.

The affected packages are react‑server‑dom‑parcel, react‑server‑dom‑turbopack, and react‑server‑dom‑webpack, all provided by Meta (Facebook). Any application utilizing these packages as part of React Server Components is susceptible. Versions of these packages under the vulnerability are not listed in the advisory, so all installations should be reviewed.

The CVSS score of 7.5 marks the issue as high‑severity. The EPSS score of 1% indicates that zero‑day exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker can exploit the flaw by sending crafted HTTP requests to Server Function endpoints over the network, potentially exhausting CPU or memory resources and causing service disruption.